How to run a vulnerability scan on your web server with Nikto2

Nikto2 is an easy to install and use website vulnerability scanner. Here’s how to make sure your servers are secure with this free open source scanner.

If you administer web servers, you know how crucial it is to keep these servers secure. Without regular monitoring, you might have a vulnerable server waiting to be exploited. For this, how do you know if your servers are vulnerable? The answers to this question are many and varied. However, if you are looking for a really simple solution, which will not cost you a penny, you can turn to Nikto2.

Nikto2 is an open source security scanner with a feature list that includes:

  • SSL support
  • Full HTTP proxy support
  • Checks for outdated server components
  • Save reports in plain text, XML, HTML, NBE or CSV
  • Template engine to easily customize reports
  • Scan multiple ports on a server
  • Scan multiple servers (via input file)
  • Easily updated via command line
  • Identifies installed software via headers, favicons and files
  • Host Authentication with Basic and NTLM
  • Subdomain riddle
  • Apache and cgiwrap username enumeration
  • Mutation techniques to “fish” content from web servers
  • Tuning scanning to include or exclude entire classes from vulnerability checks
  • Guess credentials for authorization domains
  • Permission assumption handles any directory (not just the root directory)
  • Improved reduction of false positives
  • Reports “unusual” headers

Let’s install Nikto2 and see how it is used to analyze a web server.

SEE: Power Checklist: Managing Backups (Tech Pro Research)

Facility

I will demonstrate the installation on the Ubuntu Server 16.04 platform. Since Nikto2 is Perl-based, it can be run on any platform that Perl is installed on. Here are the installation steps.

The first thing you want to do is update/upgrade your system with the following two commands:

sudo apt update
​sudo apt upgrade

Once the above commands are completed, you are ready to install. Note that if the upgrade includes the kernel, you will need to reboot, so plan that accordingly.

Install the necessary dependencies with the command:

sudo apt-get install wget unzip libnet-ssleay-perl libwhisker2-perl openssl

Navigate to the /opt directory with the cd /opt command and download the installation script with the command:

sudo wget https://cirt.net/nikto/nikto-2.1.5.tar.gz

Extract the downloaded file with the command:

sudo tar xvfz nikto-2.1.5.tar.gz

Rename the newly created directory with the command:

sudo mv nikto-2.1.5/ nikto

Switch to the newly renamed directory with the command cd nikto and give the install script the necessary permissions with the command sudo chmod +x nikto.pl.

Finally, issue the command perl nikto.pl -update to update databases and plugins.

You are ready to test.

Analysis of your website

Running a scan with Nikta2 is quite simple. You must be in the /opt/nikto directory and run the command:

perl nikto.pl -h SERVER_ADDRESS

Where SERVER_ADDRESS is either the domain or the IP address of your server. The scanner will begin the process and report what it finds (Figure A).

Figure A

Depending on the complexity of the scanned site, this process may take a few seconds or minutes. If you don’t want to have to sit and watch the output, you can always use the -o option to pipe the output to a file, such as:

perl nikto.pl -h SERVER_ADDRESS -o scan.htm

Where SERVER_ADDRESS is your server IP or domain. You can name the output file whatever you like.

The analysis won’t give you suggestions on how you can fix the problems, so you’ll have to take a bit more time, after going through the output, to figure out how to fix the problems. Also note that some of the security checks are informational only (not security rooted). It is important that you go through the report carefully after the scan is complete.

To list the different options that can be used with Nikto2, issue the command:

perl nikto.pl -h

A handy tool for your security toolbox

If you’re looking for an easy-to-use website vulnerability scanner, Nikto2 is definitely a handy tool to have in your toolbox. Although it will not solve your problems, it will certainly make you aware of them. Give Nikto2 a try and see if it becomes one of your go-to web vulnerability scanners.

Also see

Comments are closed.